Acquisition data play a critical role in the management of the U.S. Department of Defense's portfolio of weapon systems, but identifying which unclassified but potentially sensitive data require protection as Controlled Unclassified Information (CUI) and how to label them appropriately is a challenge. The authors evaluated current CUI labeling procedures, practices, and security policies and recommend improvements.